Reveal a callback endpoint signing secret

Reveals an endpoint's signing secret to a signed-in member: the value endpoints.create and endpoints.rotateSigningKey hand out once, readable again from the endpoint's own page. During a rotation both keys are returned, with the instant the overlap ends. Only a member session is accepted; an API credential or an OAuth token is refused, so an integration that needs the secret keeps the one the create or rotation that minted it returned. A disabled endpoint has nothing to reveal.